CVE-2023-42820 Random seed leakage in Jumpserver
Attackers can leak random seeds to replay verification codes and reset passwords, affecting users with local authentication and no MFA.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-42820?
CVE-2023-42820 is a high-severity vulnerability in jumpserver, published on 26 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local authentication are also not affected. Users are advised to upgrade to either version 2.28.19 or to 3.6.5. There are no known workarounds or this issue.
Weakness: CWE-200
Which versions are affected by CVE-2023-42820?
It affects 1 product.
Products include Fit2cloud Jumpserver.
How do I fix CVE-2023-42820?
No fix has been published for CVE-2023-42820 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-42820 being exploited?
There is no known exploitation of CVE-2023-42820 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in jumpserver
- CVE-2024-40628 Arbitrary File Read in Ansible Playbooks in Jumpserver
- CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
- CVE-2024-29201 JumpServer's insecure Ansible playbook validation leads to RCE in Celery
- CVE-2024-29202 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
- CVE-2023-48193 Security feature bypass in n/a
Sources
Also known as GHSA-7prv-g565-82qp.